FreeIPA-users April 2025

freeipa-users@lists.fedorahosted.org

32 participants
40 discussions

Re: FW: First login takes ages
by Ronald Wimmer 21 Apr '25

21 Apr '25

On 09.04.25 23:22, Larkin, Patrick wrote: > Are you using Automount? No. > Also, do you have lots of groups? No. > And are these identities part of an AD trust or completely internal to IPA/IDM? IPA only. I am aware of problems coming from large AD user bases. But we are talking about around 20 IPA-only users here. And maybe 25 groups.

2 2

IPA CA Broken due to expired ocspSigningCert
by Mark Selby 16 Apr '25

16 Apr '25

Our old FreeIPA cluster ipa-server-4.6.8-5.el7 (which we will upgrade if/when this issue resolved) has a non functional CA due to the ocspSigningCert being expired. I have tried all of the suggested fixes that others with this issue have suggested. ipa-cert-fix and running pki-server cert-fix directly all fail. ipa-cert-fix pki-server cert-fix --ldapi-socket /var/run/slapd-SNAFU-NET.socket --agent-uid ipara --cert ca_ocsp_signing I have also tried setting back the clock on one of the CA servers and running both ipa-cert-fix and getcert resubmit. This sugesstion https://access.redhat.com/solutions/3939431 was also tried. When I turn back the clock and restart the pki server at least I can look at the certificates as the CA. When the clock is normal the pki server will not start due to the invalid cert [13/Apr/2025:09:10:03][localhost-startStop-1]: CertUtils: verifySystemCertsByTag() failed: java.lang.Exception: Certutils.verifySystemCertValidityByNickname: faliled: nickname:ocspSigningCert cert-pki-cacause: java.lang.Exception: Certutils.verifySystemCertValidityByNickname: failed: nickname: ocspSigningCert cert-pki-ca I turned on verbose=4 logging in CS.cfg and received the below debug output. The serial number of the ocsp cert is 580 as fas the certmonger is concerned. The pki server is seemingly connecting to LDAP to lookup that cert and ends up with the Record not found error. I can not seem to find which ldap tree the server is looking in for this record or which record it is searching for. I believe that I have all the correct certs in ldap under cn=ca_renewal, but of course the ocspSigningCert in ldap is expired. Does anyone know what is happening here and what a possible fix might be. All and any help is greatly appreciated cd /etc/pki/pki-tomcat/alias certutil -L -d . -n 'ocspSigningCert cert-pki-ca' Validity: Not Before: Fri Apr 14 13:00:01 2023 Not After : Thu Apr 03 13:00:01 2025 Subject: "CN=OCSP Subsystem,O=SNAFU.NET" Version: 3 (0x2) Serial Number: 580 (0x244) dn: cn=ca_renewal,cn=ipa,cn=etc,dc=snafu,dc=net dn: cn=ipaCert,cn=ca_renewal,cn=ipa,cn=etc,dc=snafu,dc=net dn: cn=subsystemCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=snafu,dc=net dn: cn=auditSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=snafu,dc=net dn: cn=ocspSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=snafu,dc=net [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: CAProcessor.java:252:printParameterValues() CAProcessor: Input Parameters: [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: CAProcessor.java:264:printParameterValues() CAProcessor: - isRenewal: true [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: CAProcessor.java:264:printParameterValues() CAProcessor: - remoteHost: 10.17.1.18 [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: CAProcessor.java:264:printParameterValues() CAProcessor: - profileId: caManualRenewal [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: CAProcessor.java:264:printParameterValues() CAProcessor: - serial_num: 580 [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: CAProcessor.java:264:printParameterValues() CAProcessor: - remoteAddr: 10.17.1.18 [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: RenewalProcessor.java:90:processRenewal() RenewalProcessor: processRenewal() [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: RenewalProcessor.java:98:processRenewal() RenewalProcessor: profile: caManualRenewal [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: RenewalProcessor.java:149:processRenewal() RenewalProcessor: found SerialNumRenewInput [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: RenewalProcessor.java:157:processRenewal() RenewalProcessor: profile input serial_num value: 580 [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: RenewalProcessor.java:181:processRenewal() processRenewal: serial number of cert to renew:580 [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: LdapBoundConnFactory.java:324:getConn() In LdapBoundConnFactory::getConn() [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: LdapBoundConnFactory.java:326:getConn() masterConn is connected: true [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: LdapBoundConnFactory.java:368:getConn() getConn: conn is connected true [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: LdapBoundConnFactory.java:398:getConn() getConn: mNumConns now 2 [12/Apr/2025:17:55:31][http-bio-8443-exec-1]: LdapBoundConnFactory.java:444:returnConn() returnConn: mNumConns now 3 Record not found at com.netscape.cmscore.dbs.DBSSession.read(DBSSession.java:182) at com.netscape.cmscore.dbs.DBSSession.read(DBSSession.java:137) at com.netscape.cmscore.dbs.CertificateRepository.readCertificateRecord(CertificateRepository.java:1023) at com.netscape.cms.servlet.cert.RenewalProcessor.processRenewal(RenewalProcessor.java:182) at com.netscape.cms.servlet.cert.CertRequestDAO.submitRequest(CertRequestDAO.java:194) at org.dogtagpki.server.ca.rest.CertRequestService.enrollCert(CertRequestService.java:155) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:280) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:234) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:221) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:731) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:297) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:260) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:498)

2 4

Keytabs for multiple domains
by Entrepreneur AJ 15 Apr '25

15 Apr '25

I am a little confused on best way to make this work. I have a fresh install of both the latest FreeIPA server and Keycloak server, my laptop is enrolled with FreeIPA client. My browser is configured to login to my ipa domain via kerberos which works perfectly with the browser, cant seem to get ldap to authenticate with kerberos but thats not on my priority list at the moment. Both servers are running on a Vultr VPS's with private lan (vpc) enabled. FreeIPA private IP is 10.56.112.4 and Keycloak Private IP is 10.56.112.7. I have created a service account using red hat documentation and successfully been able to setup ldap user federation between the two systems over the private ip's. Keycloak operates on 3 realms: master: (Default super admin realm) at keycloak.domain1.tld intramural: (for internal systems only) at auth.domain1.tld society: (for customer facing services) at auth.domain2.tld Nginx config is restricting which domain can access which realm in case anyone was interested. On company devices I want to be able to have Kerberos automatically login to these realms. Before I install freeipa-client on the keycloak server I wanted to know how would keytabs work with each realm being on a different domain, I am using a single keycloak instance on a single server for now would i need a key tab per domain or can I just use the same key tab and some sort of hostname alias? Each nginx server stanza is set to a separate virtual ip if it helps the servers hostname itself is kc1.man-gb.domain1.tld which is routed through to the vps providers ip's and then the 3 nginx host names are from my own ip pools being announced with bgp to my provider. Any guidance would be greatly appreciated.

2 2

Demo data for containers
by Jason Frey 11 Apr '25

11 Apr '25

Hi all, Is there way to "import" the demo data that's available in the public demo instance into a local Docker-based FreeIPA server? I really only use the demo instance when I need to verify something on our application, and really don't need it other than it has a nice standard set of users and groups that make testing very simple and DNS is already set up. If I could import that same data set locally, then I wouldn't need the public instance at all. In fact, I could probably move to continuous testing if I could spin it up as a "service" for our tests. I'm guessing domains might be tricky, but it's possible we could handle that with something like nip.io? Thanks, Jason

3 4

FreeIPA Demo Server down?
by Jason Frey 11 Apr '25

11 Apr '25

Hi all, I tried using the demo server today and it appears to be down? I see demo1.freeipa.org and ipa.demo1.freeipa.org are not responding. Thanks, Jason

3 2

Can't ./configure missing kdb.h on openbsd
by Mik J 10 Apr '25

10 Apr '25

Hello, I use Openbsd and try to configure freeipa on openbsd. ./configure .... checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for popt... yes checking for krb5... yes checking for krb5-gssapi... yes checking for kdb.h... no configure: error: kdb.h not found But Heimdal on openbsd doesn't include kdb.h Is there a work around to ./configure freeipa on openbsd ? Thank you

3 2

Configuring Samba share with Kerberos authentication without ipa-adtrust-install
by Данила Скачедубов 10 Apr '25

10 Apr '25

2 3

Find hosts to be removed
by Ronald Wimmer 09 Apr '25

09 Apr '25

Every IPA host is shown either as enrolled or not in the WebGUI. Where does this come from? Simply setting the enrolledBy attribute seems to be not enough... I have to find a way to determine if a host went out of life. At first I thought I could check if the host has an enrolledBy attribute and remove all host lacking this attribute. But... "Virtual" hosts for load balancer entries created with the force option do not have this property - and they should NOT be removed. So how could I reliably differentiate between these two cases? (hosts that are OOL and host entries that are still needed but lacking the enrolledBy attribute) Cheers Ronald

2 3

First login takes ages
by Ronald Wimmer 09 Apr '25

09 Apr '25

We are on the way to switching from AD to IPA users. We observed that the first SSH login of an IPA user to a server takes almost 30 seconds. Every consecutive SSH login went blazingly fast (2 seconds at max). Initially we suspected the cache on that server. But neither that server's SSSD cache nor the SSSD cache on the corresponding IPA server had any influence here. We also tried to reboot that particular machine. Login was also around one second. We tried SSH Pubkey auth and Kerberos auth. No difference. So what could be the cause here? Any ideas? Where do we need to take a closer look? Cheers, Ronald

1 0

Unable to convert attribute 'cacertificate:binary' on Ubuntu
by Taaniel K 09 Apr '25

09 Apr '25

(this issue appears different from https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Hello, I was enrolling a FreeIPA client (v 4.12.2) on Ubuntu 24.10 and was presented with the following error [...] 2025-04-08T13:32:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2025-04-08T13:32:19Z DEBUG Initializing principal admin(a)TEST.LOCAL using password 2025-04-08T13:32:19Z DEBUG Starting external process 2025-04-08T13:32:19Z DEBUG args=['/usr/bin/kinit', 'admin(a)TEST.LOCAL', '-c', '/tmp/krbcco79q5wlq/ccache'] 2025-04-08T13:32:19Z DEBUG Process finished, return code=0 2025-04-08T13:32:19Z DEBUG stdout=Password for admin(a)TEST.LOCAL: 2025-04-08T13:32:19Z DEBUG stderr= 2025-04-08T13:32:19Z DEBUG trying to retrieve CA cert via LDAP from ipaserver.test.local 2025-04-08T13:32:19Z DEBUG retrieving schema for SchemaCache url=ldap://ipaserver.test.local:389 conn=<ldap.ldapobject.SimpleLDAPObject object at 0xfaa54c0b93d0> 2025-04-08T13:32:20Z ERROR unable to convert the attribute 'cacertificate;binary' value b'0\x82\x04H0\x82\x02\xb0\xa0\x03\x02\x01\x02\x02\x01\x010\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\x00051\x130\x11\x06\x03U\x04\n\x0c\nTEST.LOCAL1\x1e0\x1c\x06\x03U\x04\x03\x0c\x15Certificate Authority0\x1e\x17\r250408131758Z\x17\r450408131758Z051\x130\x11\x06\x03U\x04\n\x0c\nTEST.LOCAL1\x1e0\x1c\x06\x03U\x04\x03\x0c\x15Certificate Authority0\x82\x01\xa20\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\x00\x03\x82\x01\x8f\x000\x82\x01\x8a\x02\x82\x01\x81\x00\xa5\xa0\x8d\xaan8\xcb\x15\xe9\x8a\xbd\xa3\xea\xbb4A`\x93\xackX\xa5\xaa\xc5\xff\x83\x85\xf1\xfdz\xa9\xc9\x10jT\x16\xa2\\\xf9\xaf\xf4:)\xb2\xab\x03\xcf\xb1\xf44%\xfb\xf0\xb0\xafL\x05\xd7+0\xda\xff\xa6M\xf1u\xce\x07<\x16\xbax\x88\x1f\x87h\xa3\xec\x85\xadw\xf6N\xdbJ\x03\xc0\x0f\xa6\xef\xb42*sB\xc5W,\xc2t\\:\xaf\xc0Iz\xd2$o\xae\xa3t\xcb\xea}3gO\x99\xa3k\x11?\xeady\xc6\xb8P\x10L\xd0>Q\x7f\xc8}\xc9`\xf9\xa4\x01\r\x0450\x0c\x81\x89g\x84*t\xc7\xa2\x91\xab\xbd\x83l\xdf\xab\x0c\xdc\x9d\x8f<\xf0\x02 +~\xd8\x1a\xd6:P\n\xb0y`\xa2\x91\xab\x9c\xf8!\x84\np%\xb6\xdb\x8e\x18\xf8~r\x11T6\xc3\x8d\xca\nj{\xb2\x81\xa3\xbfE\xd2P\xe6U\xee_\xf4!t\x99l\x7f\x1f\xcfgN\xc0\xc7\x06\xd8T\xec\xf5\x16=\x85\xeag\x98\x1c\t{>-2\xe9\xfe\xa05\x9cx\xae\xa1\x03\xec\xc4n\xf8K\x1e\x16\xd9\x05\x14\xf2\xcb\x12k\x1d6\x1b\x7f\xe7\xab::\xd7\xd4p\xd1\xbc\xb3VRl(\xe0\xed\xef=\xb9V\x07\x90\x95\xedf\xb4&rg\xac\x01d`\xd6-\xbe\x17\x06F\xe2\x9f\xd2\x12\x0bi\x1c\xbb\xba]\xb6\xf4\xe6\x1b\x19\xb4\x8b\x98z\x11\xc2\x86\xd8\x91\'\xffbh\xc0?\xc0\xf3\xe0\x89Q\x93I8\xe3%\x14\xb4\xaa"\x87\xf7\xbe\xd5{\xb0#\xaa\xee\xd8S\x87Z\r\x80\xbf\xd7>i=\x15\x9a\xf8\xc6\xab{_\x02\x03\x01\x00\x01\xa3c0a0\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14xO\xc3\xdb\x80ji\x12fSv_nm*\xb5\xf6\xf2v\xec0\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14xO\xc3\xdb\x80ji\x12fSv_nm*\xb5\xf6\xf2v\xec0\x0f\x06\x03U\x1d\x13\x01\x01\xff\x04\x050\x03\x01\x01\xff0\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x01\xc60\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\x00\x03\x82\x01\x81\x00X\xbaO\r\xdfV}W\xf0\xc4\xaf\xa1\x85\xfdm\xa5\xfa~\\\xc3\x12\x90\x16\x1fTX\x92\x8dH\xf6R\xd7\x95\xc9\xdb\x04t?\x93\x9b\xcf\x89\x88\'>[\x15$R\x15\xf0\x1eTy\x98a\xe8\x1a\x00mp\xfaL\xd0\x00\xea\x82W,\xdc\x02AD)u\xaaGW\xbc\xa1\x15?*^\x8e\x0b\x04\xed5\xf0<\xc0\xd6mce\xb0$\x82\xcd\x8f\x94ho\xf4\xca\xe6\x95\x90\x89\x1c\x89\x04\xa1A\xbf\xdc\x9f\xa5\xa2\x7f\xb2\x88\x83\x9aE&\x9e X\xbfl$\x8a\xce\xfc\x96\x83%\xc3U\xa1\x06\xd3\xd1E\xb1\x05\xd5\x1f\xa6079\xf0\xc4\x93\x04"\x80\x8aS\x9dn\x03n\x7fx?\x0c\x13y\x8d\xe8?x\xffm\xa1Y\xd0d\xfd\x15-\xf2L\xdd">\xc5\xbc\x1b=\x91\xde\xe7!*\xf8\xf6\xb1i\x9e\xad\x8b\xee&v\xeb_\xc3\xfa\xb2\xf79\xc93\x98\xed$\xed\x896V>\xb3L\xbc\x8d\x03\xc3\x02;\x8d^\xab\xf5Nv6z\x00\xfb\x08\xbc\x02\xbf\xd8\x03\xe35y7\x10\xa3\xe7\xfa\x83~\xec\xb4]u\x1dU\x16\x94H\xb5\x7f\x08\xa6\x16\xf2\n\x19\xb1N\x82\x83-Z\x9c\xc0Aa\x8d\x1f\xe4\xf5R\xd0N#\x06\xea\xc9\x85\xd3/\x178wT\xc8\xfe\xdd\x8c\x16C\x9dA \xe25\x1e+\x16\x07\xf9P\x19t\x04@_\xec\xcbM\xe9\xc8<\xff\xd5\x8dc%`\xca\x18\xff\xfft-\xa9\x8e[\xf5\xbfV\xd9M\x07v\xd9\x19\x00[\x9cG\x95\xa3\x1bdPY\xd4\xe5@(5\xd9\xed\xd5n\xb3hB\xd4J*\xa3\x10' to type <class 'cryptography.x509.base.Certificate'> 2025-04-08T13:32:20Z DEBUG get_ca_certs_from_ldap() error: unsupported format character '\' (0x5c) at index 675 2025-04-08T13:32:20Z DEBUG unsupported format character '\' (0x5c) at index 675 The pyca/cryptography version on Ubuntu is 42.0.5, and parsing the binary string manually with pyca/cryptography v42.0.5 works without issues. The same install/enrolment process worked on AlmaLinux 9.5, although there the pyca/cryptography version is 36.0.1. The certificate contents and ASN.1 appear valid. I am therefore puzzled what could have cause the issue. The issue persists even with different IPA servers. Could you please suggest what else is there for me to check and hopefully get to the root of this issue? Thank you in advance.

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2025